OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Dmitry Shupilov (rootns.tb.by)
Date: Tue Apr 16 2002 - 02:58:53 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    Hello Charles,

    CH> Im trying to do something trivial here, but I just cant seem to figure out
    CH> whats going on. Im trying to build a gateway that only accepts ESP tunnel
    CH> packets. When I enable firewall rules something like:

    CH> /sbin/ipfw add allow udp from any to any isakmp via xl0
    CH> /sbin/ipfw add allow esp from any to any via xl0
    CH> /sbin/ipfw add deny all from any to any via xl0
    CH> /sbin/ipfw add allow all from any to any

    CH> Communications fails. The thing is, I cant figure out why.

    there is a GOLD ipfw rule:

    /sbin/ipfw add 65000 deny log ip from any to any [via[xl0][dc0] - as you wish]
                              ^^^
    you add this rule and look at your log file

    Dmitry

    To Unsubscribe: send mail to majordomoFreeBSD.org
    with "unsubscribe freebsd-security" in the body of the message